Microsoft Windows Object Packager File Extension Dialog Spoofing

Description

Vulnerability Description

Microsoft Windows Object Packages contains a flaw that may allow a malicious user to spoof filename and the associated file type in th Packager security. The issue is triggered when a slash character ('/') is included in the 'Command Line' property. It is possible that the flaw may allow execution of arbitrary shell command resulting in a loss of integrity.

Solution Description

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft Corporation has released a patch to address this vulnerability.

Short Description

Microsoft Windows Object Packages contains a flaw that may allow a malicious user to spoof filename and the associated file type in th Packager security. The issue is triggered when a slash character ('/') is included in the 'Command Line' property. It is possible that the flaw may allow execution of arbitrary shell command resulting in a loss of integrity.

All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018

{"cve": [{"lastseen": "2018-10-18T15:05:37", "references": ["http://www.securityfocus.com/bid/20318", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-065", "http://www.vupen.com/english/advisories/2006/3984", "http://www.kb.cert.org/vuls/id/703936", "http://www.securityfocus.com/archive/1/448696/100/0/threaded", "http://www.securityfocus.com/archive/1/449179/100/0/threaded", "http://securitytracker.com/id?1017037", "http://www.securityfocus.com/archive/1/448273/100/0/threaded"], "description": "Argument injection vulnerability in the Windows Object Packager (packager.exe) in Microsoft Windows XP SP1 and SP2 and Server 2003 SP1 and earlier allows remote user-assisted attackers to execute arbitrary commands via a crafted file with a \"/\" (slash) character in the filename of the Command Line property, followed by a valid file extension, which causes the command before the slash to be executed, aka \"Object Packager Dialogue Spoofing Vulnerability.\"", "edition": 4, "reporter": "NVD", "published": "2006-10-10T18:07:00", "title": "CVE-2006-4692", "type": "cve", "enchantments": {"score": {"modified": "2018-10-18T15:05:37", "vector": "NONE", "value": 6.8}}, "assessment": {"system": "http://oval.mitre.org/XMLSchema/oval-definitions-5", "name": "oval:org.mitre.oval:def:496", "href": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A496"}, "bulletinFamily": "NVD", "cvelist": ["CVE-2006-4692"], "scanner": [{"system": "http://oval.mitre.org/XMLSchema/oval-definitions-5", "name": "oval:org.mitre.oval:def:496", "href": "http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:496"}], "modified": "2018-10-17T17:39:09", "cpe": ["cpe:/o:microsoft:windows_xp::sp2:tablet_pc", "cpe:/o:microsoft:windows_2003_server:sp1", "cpe:/o:microsoft:windows_xp::sp1:tablet_pc"], "id": "CVE-2006-4692", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-4692", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "cert": [{"lastseen": "2018-08-31T02:37:30", "references": ["http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/packager_what_is_obj_pkg.mspx?mfr=true", "http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/packager_what_is_obj_pkg.mspx?mfr=true", "http://www.us-cert.gov/cas/tips/ST04-010.html", "http://www.microsoft.com/technet/security/bulletin/ms06-065.mspx", "http://www.microsoft.com/technet/security/bulletin/ms06-065.mspx", "http://www.microsoft.com/technet/security/bulletin/ms06-065.mspx", "http://www.microsoft.com/technet/security/bulletin/ms06-065.mspx", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-4692"], "description": "### Overview\n\nThe Microsoft Object Packager fails to properly display the file types. This vulnerability may allow a remote, unauthenticated attacker execute arbitrary code on a vulnerable system.\n\n### Description\n\nAccording to [Microsoft](<http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/packager_what_is_obj_pkg.mspx?mfr=true>): \n\n_Object Packager is a tool you can use to create a package that you can insert into a file. _ \nThe Object Packager fails to properly display the file types of embedded objects. According to Microsoft Security Bulletin [MS06-065](<http://www.microsoft.com/technet/security/bulletin/ms06-065.mspx>): \n \n_An attacker could try to exploit the vulnerability by creating a specially crafted file and sending the file to a user on an affected system in email or by having them click on a link to receive the file. Once the file is received the user would then have to click on the embedded object within the file and accept a misleading dialogue indicating that the user is about access a different file type. _ \nMore information is available in Microsoft Security Bulletin_ _[MS06-065](<http://www.microsoft.com/technet/security/bulletin/ms06-065.mspx>). \n \n--- \n \n### Impact\n\nAttackers can conceal the types of objects embedded within files, possibly misleading users into executing arbitrary code. \n \n--- \n \n### Solution\n\n**Apply an update** \nThis vulnerability is addressed in Microsoft Security Bulletin [MS06-065](<http://www.microsoft.com/technet/security/bulletin/ms06-065.mspx>). \n \n--- \n \n**Do not open files from untrusted sources** \n\n\nDo not open files originating from unfamiliar or unexpected sources, including those received as email attachments or hosted on a web site. For more information, please see [Using Caution with Email Attachments](<http://www.us-cert.gov/cas/tips/ST04-010.html>). \n \n--- \n \n### Systems Affected \n\nVendor| Status| Date Notified| Date Updated \n---|---|---|--- \nMicrosoft Corporation| | 10 Oct 2006| 10 Oct 2006 \nIf you are a vendor and your product is affected, [let us know](<mailto:cert@cert.org?Subject=VU%23703936 Vendor Status Inquiry>).\n\n### CVSS Metrics \n\nGroup | Score | Vector \n---|---|--- \nBase | N/A | N/A \nTemporal | N/A | N/A \nEnvironmental | N/A | N/A \n \n### References\n\n * <http://www.microsoft.com/technet/security/bulletin/ms06-065.mspx>\n * <http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/packager_what_is_obj_pkg.mspx?mfr=true>\n\n### Credit\n\nThis issue was reported in Microsoft Security Bulletin MS06-065 . Microsoft credits Andreas Sandblad of Secunia Research f or reporting this vulnerability.\n\nThis document was written by Jeff Gennari.\n\n### Other Information\n\n * CVE IDs: [CVE-2006-4692](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-4692>)\n * Date Public: 10 Oct 2006\n * Date First Published: 10 Oct 2006\n * Date Last Updated: 10 Oct 2006\n * Severity Metric: 9.90\n * Document Revision: 18\n\n", "edition": 4, "reporter": "CERT", "published": "2006-10-10T00:00:00", "title": "Microsoft Object Packager fails to properly display file types", "type": "cert", "enchantments": {"score": {"vector": "NONE", "value": 9.3}}, "bulletinFamily": "info", "cvelist": ["CVE-2006-4692", "CVE-2006-4692"], "modified": "2006-10-10T00:00:00", "id": "VU:703936", "href": "https://www.kb.cert.org/vuls/id/703936", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:19", "references": [], "description": "Microsoft Security Bulletin MS06-065\r\nVulnerability in Windows Object Packager Could Allow Remote Execution &#40;924496&#41;\r\nPublished: October 10, 2006\r\n\r\nVersion: 1.0\r\nSummary\r\n\r\nWho Should Read this Document: Customers who use Microsoft Windows\r\n\r\nImpact of Vulnerability: Remote Code Execution\r\n\r\nMaximum Severity Rating: Moderate\r\n\r\nRecommendation: Customers should consider applying the security update.\r\n\r\nSecurity Update Replacement: None\r\n\r\nCaveats: None\r\n\r\nTested Software and Security Update Download Locations:\r\n\r\nAffected Software:\r\n\u2022\t\r\n\r\nMicrosoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 \u2014 Download the update\r\n\u2022\t\r\n\r\nMicrosoft Windows XP Professional x64 Edition \u2014 Download the update\r\n\u2022\t\r\n\r\nMicrosoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 \u2014 Download the update\r\n\u2022\t\r\n\r\nMicrosoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems \u2014 Download the update\r\n\u2022\t\r\n\r\nMicrosoft Windows Server 2003 x64 Edition \u2014 Download the update\r\n\r\nNon-Affected Software:\r\n\u2022\t\r\n\r\nMicrosoft Windows 2000 Service Pack 4\r\n\r\nThe software in this list has been tested to determine whether the versions are affected. Other versions either no longer include security update support or may not be affected. To determine the support life cycle for your product and version, visit the Microsoft Support Lifecycle Web site.\r\n\r\nNote The security updates for Microsoft Windows Server 2003, Windows Server 2003 Service Pack 1, and Windows Server 2003 x64 Edition also apply to Windows Server 2003 R2.\r\nTop of sectionTop of section\r\nGeneral Information\r\n\t\r\nExecutive Summary\r\n\r\nExecutive Summary:\r\n\r\nThis update resolves a newly discovered, privately reported, vulnerability. The vulnerability is documented in the &quot;Vulnerability Details&quot; section of this bulletin.\r\n\r\nAn attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. However, significant user interaction is required to exploit this vulnerability.\r\n\r\nCustomers should consider applying the security update\r\n\r\nSeverity Ratings and Vulnerability Identifiers:\r\nVulnerability Identifiers\tImpact of Vulnerability\tWindows XP Service Pack 1\tWindows XP Service Pack 2\tWindows Server 2003\tWindows Server 2003 Service Pack 1\r\n\r\nObject Packager Dialogue Spoofing Vulnerability - CVE-2006-4692\r\n\t\r\n\r\nRemote Code Execution\r\n\t\r\n\r\nModerate\r\n\t\r\n\r\nModerate\r\n\t\r\n\r\nLow\r\n\t\r\n\r\nLow\r\n\r\nThis assessment is based on the types of systems that are affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them.\r\n\r\nNote The security updates for Windows Server 2003, Windows Server 2003 Service Pack 1, and Windows Server 2003 x64 Edition also apply to Windows Server 2003 R2.\r\n\r\nNote The severity ratings for non-x86 operating system versions map to the x86 operating systems versions as follows:\r\n\u2022\t\r\n\r\nThe Windows XP Professional x64 Edition severity rating is the same as the Windows Server 2003 Service Pack 1.\r\n\u2022\t\r\n\r\nThe Windows Server 2003 for Itanium-based Systems severity rating is the same as the Windows Server 2003 severity rating.\r\n\u2022\t\r\n\r\nThe Windows Server 2003 with SP1 for Itanium-based Systems severity rating is the same as the Windows Server 2003 Service Pack 1 severity rating.\r\n\u2022\t\r\n\r\nThe Windows Server 2003 x64 Edition severity rating is the same as the Windows Server 2003 Service Pack 1 severity rating.\r\nTop of sectionTop of section\r\n\t\r\nFrequently Asked Questions &#40;FAQ&#41; Related to This Security Update\r\n\r\nExtended security update support for Microsoft Windows 98, Windows 98 Second Edition, or Windows Millennium Edition ended on July 11, 2006. I am still using one of these operating systems; what should I do?\r\nWindows 98, Windows 98 Second Edition, and Windows Millennium Edition have reached the end of their support life cycles. It should be a priority for customers who have these operating system versions to migrate to supported versions to prevent potential exposure to vulnerabilities. For more information about the Windows Product Lifecycle, visit the following Microsoft Support Lifecycle Web site. For more information about the extended security update support period for these operating system versions, visit the Microsoft Product Support Services Web site.Extended security update support for Microsoft Windows NT Workstation 4.0 Service Pack 6a and Windows 2000 Service Pack 2 ended on June 30, 2004. Extended security update support for Microsoft Windows NT Server 4.0 Service Pack 6a ended on December 31, 2004. Extended security update support for Microsoft Windows 2000 Service Pack 3 ended on June 30, 2005. I am still using one of these operating systems; what should I do?\r\nWindows NT Workstation 4.0 Service Pack 6a, Windows NT Server 4.0 Service Pack 6a, Windows 2000 Service Pack 2, and Windows 2000 Service Pack 3 have reached the end of their support life cycles. It should be a priority for customers who have these operating system versions to migrate to supported versions to prevent potential exposure to vulnerabilities. For more information about the Windows Product Lifecycle, visit the following Microsoft Support Lifecycle Web site. For more information about the extended security update support period for these operating system versions, visit the Microsoft Product Support Services Web site.\r\n\r\nCustomers who require custom support for these products must contact their Microsoft account team representative, their Technical Account Manager, or the appropriate Microsoft partner representative for custom support options. Customers without an Alliance, Premier, or Authorized Contract can contact their local Microsoft sales office. For contact information, visit the Microsoft Worldwide Information Web site, select the country, and then click Go to see a list of telephone numbers. When you call, ask to speak with the local Premier Support sales manager. For more information, see the Windows Operating System Product Support Lifecycle FAQ.\r\n\r\nCan I use the Microsoft Baseline Security Analyzer &#40;MBSA&#41; to determine whether this update is required?\r\nThe following table provides the MBSA detection summary for this security update.\r\nProduct\tMBSA 1.2.1\tMBSA 2.0\r\n\r\nMicrosoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2\r\n\t\r\n\r\nYes\r\n\t\r\n\r\nYes\r\n\r\nMicrosoft Windows XP Professional x64 Edition\r\n\t\r\n\r\nNo\r\n\t\r\n\r\nYes\r\n\r\nMicrosoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1\r\n\t\r\n\r\nYes\r\n\t\r\n\r\nYes\r\n\r\nMicrosoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with Service Pack 1 for Itanium-based Systems\r\n\t\r\n\r\nNo\r\n\t\r\n\r\nYes\r\n\r\nMicrosoft Windows Server 2003 x64 Edition family\r\n\t\r\n\r\nNo\r\n\t\r\n\r\nYes\r\n\r\nFor more information about MBSA, visit the MBSA Web site. For more information about the programs that Microsoft Update and MBSA 2.0 currently do not detect, see Microsoft Knowledge Base Article 895660.\r\n\r\nFor more detailed information, see Microsoft Knowledge Base Article 910723.\r\n\r\nCan I use Systems Management Server &#40;SMS&#41; to determine whether this update is required?\r\nThe following table provides the SMS detection summary for this security update.\r\nProduct\tSMS 2.0\tSMS 2003\r\n\r\nMicrosoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2\r\n\t\r\n\r\nYes\r\n\t\r\n\r\nYes\r\n\r\nMicrosoft Windows XP Professional x64 Edition\r\n\t\r\n\r\nNo\r\n\t\r\n\r\nYes\r\n\r\nMicrosoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1\r\n\t\r\n\r\nYes\r\n\t\r\n\r\nYes\r\n\r\nMicrosoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with Service Pack 1 for Itanium-based Systems\r\n\t\r\n\r\nNo\r\n\t\r\n\r\nYes\r\n\r\nMicrosoft Windows Server 2003 x64 Edition family\r\n\t\r\n\r\nNo\r\n\t\r\n\r\nYes\r\n\r\nSMS 2.0 and SMS 2003 Software Update Services &#40;SUS&#41; Feature Pack can use MBSA 1.2.1 for detection and therefore have the same limitation that is listed earlier in this bulletin related to programs that MBSA 1.2.1 does not detect.\r\n\r\nFor more information about SMS, visit the SMS Web site.\r\n\r\nFor more detailed information, see Microsoft Knowledge Base Article 910723.\r\nTop of sectionTop of section\r\n\t\r\nVulnerability Details\r\n\t\r\nObject Packager Dialogue Spoofing Vulnerability - CVE-2006-4692:\r\n\r\nA remote code execution vulnerability exists in Windows Object Packager because of the way that file extensions are handled. An attacker could exploit the vulnerability by constructing a specially crafted file that could potentially allow remote code execution if a user visited a specially crafted Web site. An attacker who successfully exploited this vulnerability could take complete control of an affected system. However, significant user interaction is required to exploit this vulnerability.\r\n\t\r\nMitigating Factors for Object Packager Dialogue Spoofing Vulnerability - CVE-2006-4692:\r\n\u2022\t\r\n\r\nIn a Web-based attack scenario, an attacker would have to host a Web site that contains a Web page that is used to exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to persuade them to visit the Web site, typically by getting them to click a link that takes them to the attacker&#39;s Web site. After they click the link, they would be prompted to perform several actions. An attack could only occur after they performed these actions.\r\n\u2022\t\r\n\r\nBy default, Internet Explorer on Windows Server 2003 runs in a restricted mode that is known as Enhanced Security Configuration. This mode mitigates this vulnerability. See the FAQ section of this security update for more information about Internet Explorer Enhanced Security Configuration.\r\nTop of sectionTop of section\r\n\t\r\nWorkarounds for Object Packager Dialogue Spoofing Vulnerability - CVE-2006-4692:\r\n\r\nWe have not identified any workarounds for this vulnerability.\r\nTop of sectionTop of section\r\n\t\r\nFAQ for Object Packager Dialogue Spoofing Vulnerability - CVE-2006-4692:\r\n\r\nWhat is the scope of the vulnerability?\r\nThis is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could remotely take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. In order to exploit the vulnerability the user would have to open an .rtf file and then click on an embedded object within the file. After clicking on the object the user would then have to click on the embedded object within the file and accept a misleading dialogue indicating that the user is about access a different file type.\r\n\r\nWhat causes the vulnerability?\r\nImproper handling of files by Object Packager.\r\n\r\nWhat is Object Packager?\r\nObject Packager is a tool that can be used to create a package that can inserted into a file. For more information about Object Packager, visit the following Microsoft Product Documentation.\r\n\r\nWhat might an attacker use the vulnerability to do?\r\nAn attacker who successfully exploited this vulnerability could take complete control of the affected system.\r\n\r\nWho could exploit the vulnerability?\r\nAny anonymous user who could deliver a specially crafted message to the affected system could try to exploit this vulnerability.\r\n\r\nIn a Web-based attack scenario, an attacker would have to host a Web site that contains a Web page that is used to attempt to exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to persuade them to visit the Web site, typically by getting them to click a link that takes them to the attacker&#39;s site. It could also be possible to display specially crafted Web content by using banner advertisements or by using other methods to deliver Web content to affected systems.\r\n\r\nHow could an attacker exploit the vulnerability?\r\nAn attacker could try to exploit the vulnerability by creating a specially crafted file and sending the file to a user on an affected system in email our by having them click on a link to receive the file. Once the file is received the user would then have to click on the embedded object within the file and accept a misleading dialogue indicating that the user is about access a different file type. The file could then cause the affected system to execute code.\r\n\r\nWhat systems are primarily at risk from the vulnerability?\r\nThis vulnerability requires that a user is logged on and visits a Web site for any malicious action to occur. Therefore, any systems where Internet Explorer is used frequently, such as workstations or terminal servers, are at the most risk from these vulnerabilities.\r\n\r\nI am running Internet Explorer on Windows Server 2003. Does this mitigate this vulnerability?\r\nYes. By default, Internet Explorer on Windows Server 2003 runs in a restricted mode that is known as Enhanced Security Configuration. This mode mitigates this vulnerability.\r\n\r\nWhat is the Internet Explorer Enhanced Security Configuration?\r\nInternet Explorer Enhanced Security Configuration is a group of preconfigured Internet Explorer settings that reduce the likelihood of a user or of an administrator downloading and running specially crafted Web content on a server. Internet Explorer Enhanced Security Configuration reduces this risk by modifying many security-related settings. This includes the settings on the Security tab and the Advanced tab in the Internet Options dialog box. Some of the important modifications include the following:\r\n\u2022\t\r\n\r\nSecurity level for the Internet zone is set to High. This setting disables scripts, ActiveX controls, Microsoft Java Virtual Machine &#40;MSJVM&#41;, and file downloads.\r\n\u2022\t\r\n\r\nAutomatic detection of intranet sites is disabled. This setting assigns all intranet Web sites and all Universal Naming Convention &#40;UNC&#41; paths that are not explicitly listed in the Local intranet zone to the Internet zone.\r\n\u2022\t\r\n\r\nInstall On Demand and non-Microsoft browser extensions are disabled. This setting prevents Web pages from automatically installing components and prevents non-Microsoft extensions from running.\r\n\u2022\t\r\n\r\nMultimedia content is disabled. This setting prevents music, animations, and video clips from running.\r\n\r\nFor more information regarding Internet Explorer Enhanced Security Configuration, see the guide, Managing Internet Explorer Enhanced Security Configuration, at the following Web site.\r\n\r\nWhat does the update do?\r\nThe update removes the vulnerability by modifying the way that Windows Explorer handles Object Packager files so that the file type of the packaged file is accurately displayed.\r\n\r\nWhen this security bulletin was issued, had this vulnerability been publicly disclosed?\r\nNo. Microsoft received information about this vulnerability through responsible disclosure.\r\n\r\nWhen this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?\r\nNo. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.\r\n\r\nAcknowledgments\r\n\r\nMicrosoft thanks the following for working with us to help protect customers:\r\n\u2022\t\r\n\r\nAndreas Sandblad of Secunia Research for reporting the Object Packager Dialogue Spoofing Vulnerability - CVE-2006-4692\r\n\r\nDisclaimer:\r\n\r\nThe information provided in the Microsoft Knowledge Base is provided &quot;as is&quot; without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\r\n\r\nRevisions: \r\n\u2022\t\r\n\r\nV1.0 &#40;October 10, 2006&#41;: Bulletin published.", "edition": 1, "reporter": "Securityvulns", "published": "2006-10-11T00:00:00", "title": "Microsoft Security Bulletin MS06-065 Vulnerability in Windows Object Packager Could", "type": "securityvulns", "enchantments": {"score": {"modified": "2018-08-31T11:10:19", "vector": "NONE", "value": 9.3}}, "bulletinFamily": "software", "affectedSoftware": [], "cvelist": ["CVE-2006-4692"], "modified": "2006-10-11T00:00:00", "id": "SECURITYVULNS:DOC:14618", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:14618", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-08-31T11:10:19", "references": [], "description": "====================================================================== \r\n\r\n Secunia Research 11/10/2006\r\n\r\n - Microsoft Windows Object Packager Dialog Spoofing -\r\n\r\n====================================================================== \r\nTable of Contents\r\n\r\nAffected Software....................................................1\r\nSeverity.............................................................2\r\nDescription of Vulnerability.........................................3\r\nSolution.............................................................4\r\nTime Table...........................................................5\r\nCredits..............................................................6\r\nReferences...........................................................7\r\nAbout Secunia........................................................8\r\nVerification.........................................................9\r\n\r\n====================================================================== \r\n1&#41; Affected Software \r\n\r\n* Windows XP\r\n* Windows 2003 Server\r\n\r\nNOTE: Other versions may also be affected.\r\n\r\n====================================================================== \r\n2&#41; Severity \r\n\r\nRating: Less critical\r\nImpact: Spoofing\r\n System access\r\nWhere: Remote\r\n\r\n====================================================================== \r\n3&#41; Description of Vulnerability\r\n\r\nSecunia Research has discovered a vulnerability in Microsoft Windows,\r\nwhich can be exploited by malicious people to conduct spoofing attacks.\r\n\r\nThe vulnerability is caused due to an input validation error in the\r\nObject Packager &#40;packager.exe&#41; in the handling of the &quot;Command Line&quot;\r\nproperty. This can be exploited to spoof the filename and the\r\nassociated file type in the Packager security dialog by including a &quot;/&quot;\r\nslash character in the &quot;Command Line&quot; property.\r\n\r\nExample:\r\ncmd /c [shell command] /[file].txt\r\n\r\nThis can further be exploited to execute arbitrary shell commands on a\r\nuser&#39;s system by tricking a user into opening and interacting with e.g.\r\na malicious Rich Text document or Word document containing an embedded\r\nPackage object in e.g. WordPad. \r\n\r\n====================================================================== \r\n4&#41; Solution \r\n\r\nApply patches issued by Microsoft.\r\n\r\n====================================================================== \r\n5&#41; Time Table \r\n\r\n28/06/2006 - Vendor notified.\r\n28/06/2006 - Vendor response.\r\n11/09/2006 - Vendor contacted &#40;status requested&#41;.\r\n10/10/2006 - Vendor issues security bulletin MS06-065.\r\n11/10/2006 - Public disclosure.\r\n\r\n====================================================================== \r\n6&#41; Credits \r\n\r\nDiscovered by Andreas Sandblad, Secunia Research.\r\n\r\n====================================================================== \r\n7&#41; References\r\n\r\nMS06-065:\r\nhttp://www.microsoft.com/technet/security/Bulletin/MS06-065.mspx\r\n\r\nThe Common Vulnerabilities and Exposures &#40;CVE&#41; project has assigned \r\nCVE-2006-4692 for the vulnerability.\r\n\r\n====================================================================== \r\n8&#41; About Secunia\r\n\r\nSecunia offers vulnerability management solutions to corporate\r\ncustomers with verified and reliable vulnerability intelligence\r\nrelevant to their specific system configuration:\r\n\r\nhttp://corporate.secunia.com/\r\n\r\nSecunia also provides a publicly accessible and comprehensive advisory\r\ndatabase as a service to the security community and private \r\nindividuals, who are interested in or concerned about IT-security.\r\n\r\nhttp://secunia.com/\r\n\r\nSecunia believes that it is important to support the community and to\r\ndo active vulnerability research in order to aid improving the \r\nsecurity and reliability of software in general:\r\n\r\nhttp://corporate.secunia.com/secunia_research/33/\r\n\r\nSecunia regularly hires new skilled team members. Check the URL below to\r\nsee currently vacant positions:\r\n\r\nhttp://secunia.com/secunia_vacancies/\r\n\r\nSecunia offers a FREE mailing list called Secunia Security Advisories:\r\n\r\nhttp://secunia.com/secunia_security_advisories/ \r\n\r\n====================================================================== \r\n9&#41; Verification \r\n\r\nPlease verify this advisory by visiting the Secunia website:\r\nhttp://secunia.com/secunia_research/2006-54/\r\n\r\nComplete list of vulnerability reports published by Secunia Research:\r\nhttp://secunia.com/secunia_research/\r\n\r\n======================================================================\r\n\r\n\r\n", "edition": 1, "reporter": "Securityvulns", "published": "2006-10-12T00:00:00", "title": "Secunia Research: Microsoft Windows Object Packager Dialog Spoofing", "type": "securityvulns", "enchantments": {"score": {"modified": "2018-08-31T11:10:19", "vector": "NONE", "value": 7.5}}, "bulletinFamily": "software", "affectedSoftware": [], "cvelist": ["CVE-2006-4692"], "modified": "2006-10-12T00:00:00", "id": "SECURITYVULNS:DOC:14638", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:14638", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2018-11-17T03:17:18", "references": ["https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2006/ms06-065"], "pluginID": "22538", "description": "The remote host runs a version of Windows that has a flaw in its Object Packager.\n\nThe flaw could allow an attacker to execute code on the remote host.\n\nTo exploit this vulnerability, an attacker needs to entice a user to visit a malicious website.", "edition": 7, "reporter": "Tenable", "published": "2006-10-10T00:00:00", "title": "MS06-065: Vulnerability in Windows Object Packager Could Allow Remote Execution (924496)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Windows : Microsoft Bulletins", "bulletinFamily": "scanner", "cvelist": ["CVE-2006-4692"], "modified": "2018-11-15T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS06-065.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=22538", "sourceData": "#\n# Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(22538);\n script_version(\"1.27\");\n script_cvs_date(\"Date: 2018/11/15 20:50:30\");\n\n script_cve_id(\"CVE-2006-4692\");\n script_bugtraq_id(20318);\n script_xref(name:\"CERT\", value:\"703936\");\n script_xref(name:\"MSFT\", value:\"MS06-065\");\n script_xref(name:\"MSKB\", value:\"924496\");\n\n script_name(english:\"MS06-065: Vulnerability in Windows Object Packager Could Allow Remote Execution (924496)\");\n script_summary(english:\"Checks the remote registry for 9224496\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"It is possible to execute code on the remote host.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host runs a version of Windows that has a flaw in its Object\nPackager.\n\nThe flaw could allow an attacker to execute code on the remote host.\n\nTo exploit this vulnerability, an attacker needs to entice a user to\nvisit a malicious website.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2006/ms06-065\");\n script_set_attribute(attribute:\"solution\", value:\"Microsoft has released a set of patches for Windows XP and 2003.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2006/10/10\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/10/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/10/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(english:\"This script is Copyright (C) 2006-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, 'Host/patch_management_checks');\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS06-065';\nkb = '924496';\n\nkbs = make_list(kb);\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(xp:'1,2', win2003:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nrootfile = hotfix_get_systemroot();\nif (!rootfile) exit(1, \"Failed to get the system root.\");\n\nshare = hotfix_path2share(path:rootfile);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif ( hotfix_is_vulnerable(os:\"5.2\", sp:0, file:\"Shdocvw.dll\", version:\"6.0.3790.588\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"5.2\", sp:1, file:\"Shdocvw.dll\", version:\"6.0.3790.2783\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"5.1\", sp:1, file:\"Shdocvw.dll\", version:\"6.0.2800.1892\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"5.1\", sp:2, file:\"Shdocvw.dll\", version:\"6.0.2900.2987\", dir:\"\\system32\", bulletin:bulletin, kb:kb) )\n{\n set_kb_item(name:\"SMB/Missing/\"+bulletin, value:TRUE);\n hotfix_security_warning();\n\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}